This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

computer running slowly, please help /Hijack log attached

36 min read

This thread's last reply is from February 15, 2006, 8:43 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

mrclean575
February 2, 2006, 2:28 AM UTC
I'm running Spyware Blaster, SpyBot S&D, Clean up, Ewido, Win Patrol, Housecall, Norton and still have picked something up.


Logfile of HijackThis v1.99.1
Scan saved at 9:19:11 PM, on 2/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NAVW32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ken Schram\Desktop\downloads\programs\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dial
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydial/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydial/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydial/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dial
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydial/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKCU\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /M "Stylus Photo R200" /EF "HKCU"
O4 - HKCU\..\Run: [Systweak Wallpaper Changer] wallpaper.exe -minimize
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Support - {2172C3A7-BB00-4CA4-B4CF-6A7B07CB0072} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/applet-6.4.3.36/omaha/omaha-ob-assets.cab
O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-6.2.2.66/aces/aces-ob-assets.cab
O16 - DPF: Ali Baba Slots TM by pogo - http://game1.pogo.com/applet-6.3.3.38/slots/alibaba-ob-assets.cab
O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.2.2.66/backgammon/backgammon-ob-assets.cab
O16 - DPF: Blackjack by pogo - http://game1.pogo.com/applet-6.4.2.23/blackjack/blackjack-ob-assets.cab
O16 - DPF: Buckaroo Blackjack TM by pogo - http://game1.pogo.com/applet-6.2.5.28/videoblackjack/videoblackjack-ob-assets.cab
O16 - DPF: Checkers by pogo - http://game1.pogo.com/applet-6.2.3.36/checkers2/checkers-ob-assets.cab
O16 - DPF: Cribbage by pogo - http://game1.pogo.com/applet-6.2.3.36/cribbage/cribbage-ob-assets.cab
O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-6.2.1.41/checkeredflag/checkeredflag-ob-assets.cab
O16 - DPF: EZ Win Bingo by pogo - http://game1.pogo.com/applet-6.2.5.42/bingo/bingoe-ob-assets.cab
O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-6.2.0.30/solitaire2/solitaire2-ob-assets.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.4.1.53/superbingo/superbingo-ob-assets.cab
O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.2.5.28/harvest/harvest-ob-assets.cab
O16 - DPF: Hearts by pogo - http://game1.pogo.com/applet-6.4.4.34/hearts/hearts-ob-assets.cab
O16 - DPF: High Stakes Poker by pogo - http://game1.pogo.com/applet-6.2.1.34/drawpoker/drawpoker-ob-assets.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.2.2.66/pool2/pool-ob-assets.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.4.2.30/gin/gin-ob-assets.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.4.2.23/lottso/lottso-ob-assets.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.4.3.36/mahjong/mahjong-ob-assets.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.3.4.64/mlslots/mlslots-ob-assets.cab
O16 - DPF: Pai Gow by pogo - http://game1.pogo.com/applet-6.2.1.34/paigow/paigow-ob-assets.cab
O16 - DPF: Payday FreeCell by pogo - http://game1.pogo.com/applet-6.4.1.53/freecell/freecell-ob-assets.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-6.3.0.46/waterwheel/waterwheel-ob-assets.cab
O16 - DPF: Pinochle by pogo - http://game1.pogo.com/applet-6.2.5.28/pinochle/pinochle-ob-assets.cab
O16 - DPF: PoppaZoppa by pogo - http://game1.pogo.com/applet-6.2.5.28/poppazoppa/poppazoppa-ob-assets.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-6.4.2.30/poppit2/poppit2-ob-assets.cab
O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.5.0.45/hotstreak/hotstreak-ob-assets.cab
O16 - DPF: QWERTY by pogo - http://game1.pogo.com/applet-6.4.2.23/squares/squares-ob-assets.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.3.0.53/slots/showbiz2-ob-assets.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.2.0.37/slots/showbiz-ob-assets.cab
O16 - DPF: Spider Solitaire by pogo - http://game1.pogo.com/applet-6.2.1.27/spider/spider-ob-assets.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.2.2.51/squelchies/squelchies-ob-assets.cab
O16 - DPF: Stellar Sweeper by pogo - http://game1.pogo.com/applet-6.4.2.23/sweeper/sweeper-ob-assets.cab
O16 - DPF: Sweet Tooth TM by pogo - http://game1.pogo.com/applet-6.2.4.32/sweettooth/sweettooth-ob-assets.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.2.5.28/holdem/holdem-ob-assets.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-6.3.0.46/peaks/peaks-ob-assets.cab
O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-6.2.0.37/jumbee/jumbee-ob-assets.cab
O16 - DPF: Turbo 21 TM by pogo - http://game1.pogo.com/applet-6.2.3.36/turbo21/turbo21-ob-assets.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.4.4.34/wordwhomp2/whomp2-ob-assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.2.5.28/whackdown/whackdown-ob-assets.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.2.3.39/wordjong/wordjong-ob-assets.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.4.2.23/worldclass/worldclass-ob-assets.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1138311113640
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax2822.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Rogue
February 2, 2006, 3:59 AM UTC
Hi mrclean575,

Welcome to the Malware Removal forums. I will be more than happy to help you work on your problems.
Please give me some time to review your log as this can be a lengthy process. As soon as a MR Staff Expert reviews my fix, I will post it for you.
In the mean time, if any problems occur. Please let me know.
Please only use this topic to reply to. Do not start another thread.
The fixes we will use are specific to your problems and should only be used for this issue on this machine.
If you’re unsure of anything at all please stop and ask!

Rogue
Rogue
February 2, 2006, 9:57 PM UTC
Hi mrclean575,

There are a few lines in your HJT that have been known to slow systems. You may want to look at the lines in HJT that are 016 related pogo and delete those for games you do not play.

Aside from those I see nothing that would raise concern. To make sure nothing is hiding I’ll have you perform some scans.

Lets roll.

You may already have some of these but please make sure that they are updated and configured as below:
Download and install Ewido Anti-Malware

During the installation, uncheck the following under Additional Options:
Install background guard
Install scan via context menu

Check for updates
Do not run it yet
==========

Clean out your Temp files as follows:
At the top, click Tools>Internet Options> and then, in the center click Delete Cookies
Click Delete Files and then in the new applet check the box for all offline content
Click OK
Close that applet and open the C>Windows>Temp folder, and delete all files in there too, and all files in sub-folders of Temp.
Empty the C:\Windows\Prefetch Folder about once a month. More if you use the internet a lot.
Empty ALL C:\Documents and Settings\user name here\LocalSettings\Temp Folders

Empty your Recycle Bin
==========

Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'.
Place a checkmark in the boxes to the left of the following entries, by clicking on them:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydial/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydial/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydial/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydial/*http://www.yahoo.com

O16 - Lines by pogo for games you do not play.

CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked
==========

Run ewido Malware Remover

Click on Scanner
Click on Complete System Scan and the scan will begin.
While the scan is in progress you will be prompted to clean files, click OK
Select "none" as the action. DO NOT check "Perform action with all infections ". If you are unsure of an entry, select "none" for the time being.
Once the scan has completed, there will be a button located on the bottom of the screen named Save report - click it.
Save the report.txt file to your desktop.

Now close ewido security suite.

Warning: While the scan is in progress, DO NOT open any folders or the Windows Control Panel !!
==========

Run an online virus scan called Kapersky from here.

1. Click on "Kapersky Online Scanner"
2. A new smaller window will pop up. Press on "Accept". After reading the contents.
3. Now Kapersky will update the anti-virus database. Let it run.
4. Click on "Next">"Scan Settings", and make sure the database is set to "extended". And check both the scan options. Then click OK.
5. Then click on "My Computer". And the scan will start.
6. Once finished, save a log as ".txt" to the desktop. And restart.
==========

Post a new HJT Log
Post ewido Log
Post .txt from Kapersky
Any comments on how your system is performing.

Thanks,
Rogue
mrclean575
February 3, 2006, 2:55 AM UTC
All programs are opening slowly, many times they freeze up. The hour glass pops up periodically, for no apparent reason. I open IE, it'll take 5-10 seconds for my home page to load. Web pages in general take forever to load. Attached are the items that you've requested. Any help is greatly appreciated.

Logfile of HijackThis v1.99.1
Scan saved at 9:43:16 PM, on 2/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Ken Schram\Desktop\downloads\programs\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dial
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dial
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKCU\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /M "Stylus Photo R200" /EF "HKCU"
O4 - HKCU\..\Run: [Systweak Wallpaper Changer] wallpaper.exe -minimize
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Support - {2172C3A7-BB00-4CA4-B4CF-6A7B07CB0072} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: Ali Baba Slots TM by pogo - http://game1.pogo.com/applet-6.3.3.38/slots/alibaba-ob-assets.cab
O16 - DPF: Blackjack by pogo - http://game1.pogo.com/applet-6.4.2.23/blackjack/blackjack-ob-assets.cab
O16 - DPF: Buckaroo Blackjack TM by pogo - http://game1.pogo.com/applet-6.2.5.28/videoblackjack/videoblackjack-ob-assets.cab
O16 - DPF: EZ Win Bingo by pogo - http://game1.pogo.com/applet-6.2.5.42/bingo/bingoe-ob-assets.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.4.1.53/superbingo/superbingo-ob-assets.cab
O16 - DPF: Hearts by pogo - http://game1.pogo.com/applet-6.4.4.34/hearts/hearts-ob-assets.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.4.2.30/gin/gin-ob-assets.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.4.3.36/mahjong/mahjong-ob-assets.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.3.4.64/mlslots/mlslots-ob-assets.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-6.3.0.46/waterwheel/waterwheel-ob-assets.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-6.4.2.30/poppit2/poppit2-ob-assets.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.3.0.53/slots/showbiz2-ob-assets.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.2.0.37/slots/showbiz-ob-assets.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.4.4.34/wordwhomp2/whomp2-ob-assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.2.5.28/whackdown/whackdown-ob-assets.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.2.3.39/wordjong/wordjong-ob-assets.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/ ... nicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1138311113640
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax2822.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe



-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Thursday, February 02, 2006 21:40:48
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 3/02/2006
Kaspersky Anti-Virus database records: 174480
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 53293
Number of viruses found: 92
Number of infected objects: 305
Number of suspicious objects: 3
Duration of the scan process: 5507 sec

Infected Object Name - Virus Name
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/CHCON.dll Infected: not-a-virus:AdWare.Win32.EZula.ae
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/eabh.dll Infected: not-a-virus:AdWare.Win32.EZula.x
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/CHCON.dll Infected: not-a-virus:AdWare.Win32.EZula.ae
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/eabh.dll Infected: not-a-virus:AdWare.Win32.EZula.x
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/mmod.exe Infected: not-a-virus:AdWare.Win32.EZula.z
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/seng.dll Infected: not-a-virus:AdWare.Win32.EZula.ab
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip Infected: not-a-virus:AdWare.Win32.EZula.ab
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/mdefshop.dll Infected: not-a-virus:AdWare.Win32.WurldMedia.e
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip Infected: not-a-virus:AdWare.Win32.WurldMedia.e
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\00214A73.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\036B027A.class Infected: Trojan.Java.ClassLoader.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\036E2C77.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\04993639.dll Infected: Trojan-Clicker.Win32.Small.ez
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\060C1E99.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\07FE20BE.dll Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\08160957.class Infected: Trojan.Java.Femad
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\08160957.htm Infected: Trojan-Downloader.JS.Small.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\089F6CC0.class Infected: Trojan.Java.ClassLoader.i
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\08C33A99.class Infected: Trojan.Java.ClassLoader.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\09112A42.class Infected: Trojan-Downloader.Java.OpenConnection.l
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\099B0DAB.class Infected: Trojan.Java.ClassLoader.i
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\099E37A8.class Infected: Trojan.Java.ClassLoader.k
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\09E95953.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\0BA60726 Infected: Trojan.Win32.Delf.gh
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\0D580F0C.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\0DF372BE Infected: not-a-virus:AdWare.Win32.BiSpy.m
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\0FAA7BAF.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\110529DF Infected: not-a-virus:AdWare.Win32.EZula.z
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\110A2B7C.class Infected: Trojan.Java.ClassLoader.i
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\12446A23.class Infected: Trojan.Java.ClassLoader.l
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\12446A23.htm Suspicious: Exploit.HTML.Mht
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\138E5CBD.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\13B0454F.exe Infected: Email-Worm.Win32.VB.an
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\14532902.exe Infected: Email-Worm.Win32.NetSky.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\15141F4A.exe Infected: Trojan-Dropper.Win32.Small.qn
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\151444BA Infected: not-a-virus:AdWare.Win32.EZula.ae
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\157A1552.exe Infected: not-a-virus:AdWare.Win32.WinAD.aw
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1AAA10A1 Infected: Trojan-Dropper.Win32.Small.gv
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1B4F5BA1.dat Infected: P2P-Worm.Win32.Tibick.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1B552F9A.dat Infected: P2P-Worm.Win32.Tibick.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1C9565DD Infected: not-a-virus:AdWare.Win32.Sidesearch.e
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1F1E18BC.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FB80268.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FB80268.exe/data0003 Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FB80268.exe Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FBC2C64.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.e
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FBC2C64.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FBC2C64.exe/data0003 Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FBC2C64.exe Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FBF5661.dll Infected: not-a-virus:AdWare.Win32.HotSearchBar.i
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.dll Infected: not-a-virus:AdWare.Win32.HotSearchBar.i
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0004/stream/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0004/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.aa
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0004/stream/data0006 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0004/stream/data0007 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0004/stream/data0008 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0004/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0005/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0005/stream/data0006 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0005/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0006/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.l
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0006/stream/data0006 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0006/stream/data0007 Infected: not-a-virus:AdWare.Win32.CashBack.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0006/stream/data0008 Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0006/stream Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe/stream Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC2005D.exe Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC52A5A.exe Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC95456.dat Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FC95456.dll Infected: Trojan-Downloader.Win32.Qoologic.p
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1FCC7E53.dat Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\208B287E Infected: Trojan-Clicker.Win32.Morwill.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\20A45B49.exe/data0003 Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\20A45B49.exe Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\2260000F.exe Infected: Trojan-Dropper.Win32.Agent.pb
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22632A0C.exe Infected: Trojan-Dropper.Win32.Agent.pb
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22665408.com Infected: Trojan-Dropper.Win32.Agent.pb
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22665408.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.e
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\226A7E04.dat Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\226D2801.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\227051FD.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22747BFA.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\227725F6 Infected: Trojan-Downloader.Win32.Small.abd
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\227725F6.exe Infected: Trojan-Downloader.Win32.Small.abd
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\227725F6.vxd Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\227A4FF2.exe Infected: not-a-virus:AdWare.Win32.WinAD.aw
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\227A4FF2.srg Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\227D79EF.dll Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22844DE8.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\228777E4.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\228A21E0 Infected: Trojan-Downloader.Win32.Qoologic.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\228A21E0.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\228E4BDD.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\229175D9.dat Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22941FD6.dat Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22941FD6.exe Infected: Trojan-Downloader.Win32.Small.abd
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22970841 Infected: Trojan-Downloader.Win32.PurityScan.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\229E5C3A Infected: not-a-virus:AdWare.Win32.VirtualBouncer.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22A10636 Infected: Trojan.Win32.Scapur.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\22CE7A3C Infected: not-a-virus:AdWare.Win32.BargainBuddy.aa
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\257561D1.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\25780BCE.dll Infected: Trojan-Downloader.Win32.Qoologic.s
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\25780BCE.exe Infected: Trojan-Downloader.Win32.Qoologic.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\257C35CA.dll Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\257C35CA.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\257F5FC7.dat Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\25C97133.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\262B2D0C Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\27AB7A7A Infected: not-a-virus:AdWare.Win32.BargainBuddy.l
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\282621DC Infected: not-a-virus:AdWare.Win32.EZula.g
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\28B91DE6 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\2B0B59B8 Infected: not-a-virus:AdWare.Win32.EZula.x
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\2B122DB1 Infected: not-a-virus:AdWare.Win32.EZula.x
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\2C341748.exe Infected: not-a-virus:AdWare.Win32.WeirWeb.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\2C6F342F.class Infected: Trojan.Java.ClassLoader.k
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\2F9E60C4/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\2F9E60C4 Infected: not-a-virus:AdWare.Win32.PurityScan.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\312D74A2.class Infected: Trojan.Java.ClassLoader.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\31BC690B Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\33BA563F.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\34B3049B.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\37022F7E Infected: Trojan-Downloader.Win32.Stubby.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\3705597A Infected: not-a-virus:AdWare.Win32.BiSpy.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\37080377 Infected: not-a-virus:AdWare.Win32.BiSpy.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\370C2D73 Infected: not-a-virus:AdWare.Win32.EZula.ae
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\370F5770 Infected: not-a-virus:AdWare.Win32.EZula.ae
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\37152B68 Infected: not-a-virus:AdWare.Win32.EZula.z
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\37195565 Infected: not-a-virus:AdWare.Win32.BiSpy.r
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\371C7F61 Infected: not-a-virus:AdWare.Win32.Sidesearch.e
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\371F295E Infected: not-a-virus:AdWare.Win32.EZula.ab
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\3722535A Infected: not-a-virus:AdWare.Win32.EZula.g
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\37267D56 Infected: not-a-virus:AdWare.Win32.BiSpy.m
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\39677527.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\3F463A5D.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\3FAC0FE1 Infected: not-a-virus:AdWare.Win32.EZula.ae
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4044409A.dll Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\404C77C6.htm Suspicious: Exploit.HTML.Mht
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\410A0708 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42296013.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\423542BF.exe Infected: Trojan-Dropper.Win32.Agent.pb
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\428F2B62.class Infected: Trojan.Java.ClassLoader.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4290765E.exe Infected: Trojan-Downloader.Win32.VB.ft
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42992957.htm Infected: Exploit.HTML.Mht
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\429C5353.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\429F7D50.htm Infected: Exploit.VBS.Phel.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42A2274C.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42A65149.htm Infected: Exploit.VBS.Phel.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42A97B45.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42A97B45.htm Infected: Exploit.HTML.Mht
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42AC2541.htm Infected: Exploit.VBS.Phel.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42C0212C.htm Infected: Exploit.VBS.Phel.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42C34B28.htm Infected: Exploit.VBS.Phel.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\42D31D16.htm Infected: Exploit.VBS.Phel.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\43D310E8.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\43F867EC.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\43FD09CF.ani Infected: Trojan-Downloader.Win32.Ani.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\440033CC.jar/BlackBox.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\440033CC.jar/VerifierBug.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\440033CC.jar/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\440033CC.jar Infected: Trojan-Downloader.Java.OpenConnection.aa
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\44217B54.exe/data0002 Infected: Trojan.Win32.Registrator.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\44217B54.exe/data0003 Infected: Trojan-Downloader.Win32.Small.ayh
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\44217B54.exe Infected: Trojan-Downloader.Win32.Small.ayh
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\445E5DF4.class Infected: Trojan.Java.ClassLoader.k
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4507662F.dll Infected: Trojan-Clicker.Win32.Small.ez
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\49EC1845.exe Infected: Trojan-Downloader.Win32.VB.ft
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4AE835C9.dat Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4B3D4BDF Infected: not-a-virus:AdWare.Win32.IPInsight.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4BA24F84 Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4C0F0754.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4EBC37DC.class Infected: Trojan.Java.ClassLoader.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4F920086.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\4FF609D1 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\50182D5A.exe Infected: Trojan-Downloader.Win32.Apropo.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\50BC22C3.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\50BF4CC0.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\52093E13.exe Infected: Trojan-Dropper.Win32.Small.qn
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\52D45F06.dll Infected: Trojan-Clicker.Win32.Small.ez
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\53482D52.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\577F73ED.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\5BA86959.exe/data0000.bin Infected: Trojan-Downloader.Win32.Apropo.g
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\5BA86959.exe/data0002.bin Infected: Trojan-Downloader.Win32.Apropo.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\5BA86959.exe Infected: Trojan-Downloader.Win32.Apropo.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\5FD46DA4.class Infected: Trojan.Java.ClassLoader.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\5FD717A1.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\60634F0D Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\625D43DD Infected: not-a-virus:AdWare.Win32.EZula.ab
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\62B5058A.dat Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\64556954 Infected: not-a-virus:AdWare.Win32.BiSpy.m
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\64581350 Infected: Trojan-Downloader.Win32.Agent.ab
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\64E676BB.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\65024E9D.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\650C4C92.htm Suspicious: Exploit.HTML.Mht
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\650F768F.class Infected: Trojan.Java.ClassLoader.Dummy.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6510629F.dll Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6512208B.class Infected: Trojan.Java.ClassLoader.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\65164A87.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\65197484.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\651C1E80.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\651F487D.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\690E6790.htm Infected: Exploit.HTML.Mht
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69390961.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69390961.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69390961.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69390961.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69390961.zip Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69802512.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69802512.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69802512.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69802512.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\69802512.zip Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6AC70B80.dll Infected: Trojan-Clicker.Win32.Small.ez
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6BF30B0B Infected: not-a-virus:AdWare.Win32.CashBack.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6CC76154.class Infected: Exploit.Java.ByteVerify
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6D8D121F.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6D8D121F.class Infected: Trojan.Java.ClassLoader.h
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6E4D3F4B.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6E646532.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6E6E6327.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6FF71E59.class Infected: Trojan.Java.ClassLoader.d
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\70260ACC.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ag
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\707732BA.dll Infected: not-a-virus:AdWare.Win32.BargainBuddy.l
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71AE0D5E.exe/data0002 Infected: not-a-virus:AdWare.Win32.BetterInternet.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71AE0D5E.exe/data0003/data0001 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71AE0D5E.exe/data0003 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71AE0D5E.exe Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71B56157.dll Infected: not-a-virus:AdWare.Win32.EliteBar.af
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71B56157.exe Infected: Trojan-Dropper.Win32.Agent.pb
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71B80B54.exe Infected: Trojan-Downloader.Win32.Apropo.ad
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71BC3550.exe Infected: Trojan-Downloader.Win32.Apropo.ad
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71C20949.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71C53345.exe Infected: Trojan-Downloader.Win32.Apropo.ad
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71C95D42.exe Infected: Trojan-Downloader.Win32.Apropo.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71CC073E.exe/data0000.bin Infected: Trojan-Downloader.Win32.Apropo.g
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71CC073E.exe/data0002.bin Infected: Trojan-Downloader.Win32.Apropo.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71CC073E.exe Infected: Trojan-Downloader.Win32.Apropo.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71CF313B.com Infected: Trojan-Dropper.Win32.Agent.pb
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71CF313B.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.e
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71D25B37.DLL Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71D25B37.exe Infected: Trojan-Downloader.Win32.Apropo.ad
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71D60533.exe Infected: Trojan-Downloader.Win32.Apropo.ab
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71D92F30.exe Infected: Trojan-Downloader.Win32.Qoologic.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71DF0329.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71E32D25.exe Infected: Trojan-Downloader.Win32.Qoologic.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71E65721.dll Infected: Trojan-Downloader.Win32.Qoologic.t
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71E65721.exe/data0001 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71E65721.exe Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71ED2B1A.exe Infected: not-a-virus:AdWare.Win32.WinAD.aw
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71F37F13.dll Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71F37F13.exe Infected: Trojan-Downloader.Win32.Pacer.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71FA530C.exe Infected: Trojan-Downloader.Win32.Pacer.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\71FD7D08.exe Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72002705.exe Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72035101.exe Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72077AFD.exe Infected: Trojan-Downloader.Win32.Pacer.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\720A24FA.exe Infected: Trojan-Downloader.Win32.Qoologic.v
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\720D4EF6.cpl Infected: Trojan-Downloader.Win32.Qoologic.p
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\720D4EF6.exe Infected: Trojan-Downloader.Win32.Qoologic.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\721078F3.exe Infected: not-a-virus:AdWare.Win32.SafeSurfing.i
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\721422EF.dat Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72174CEB.exe/data0002 Infected: not-a-virus:AdWare.Win32.BetterInternet.a
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72174CEB.exe/data0003/data0001 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72174CEB.exe/data0003 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72174CEB.exe Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\721A76E8.exe/data0003 Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\721A76E8.exe Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\721D20E4.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72214AE1.dll Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\722474DD.cab/wupdt.exe Infected: Trojan-Downloader.Win32.OneClickNetSearch.f
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\722474DD.cab Infected: Trojan-Downloader.Win32.OneClickNetSearch.f
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\722474DD.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\722474DD.exe Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72271ED9.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72271ED9.exe Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\722B48D6.dat Infected: Trojan-Downloader.Win32.Qoologic.u
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\74903444.php Infected: Exploit.HTML.Mht
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\749A3239.class Infected: Trojan.Java.ClassLoader.h
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\770A233F/data0001 Infected: Trojan-Downloader.NSIS.Agent.f
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\770A233F Infected: Trojan-Downloader.NSIS.Agent.f
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\77107738 Infected: not-a-virus:AdWare.Win32.BiSpy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\77174B31/data0003/data0001 Infected: not-a-virus:AdWare.Win32.WebRebates.g
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\77174B31/data0003 Infected: not-a-virus:AdWare.Win32.WebRebates.g
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\77174B31/data0003 Infected: not-a-virus:AdWare.Win32.WebRebates.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\77174B31/data0004 Infected: not-a-virus:AdWare.Win32.HelpExpress
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\77174B31/data0005 Infected: not-a-virus:AdWare.Win32.WebRebates.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\77174B31 Infected: not-a-virus:AdWare.Win32.WebRebates.b
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7784470A Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\78401927 Infected: not-a-virus:AdWare.Win32.BookedSpace.e
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\78D86859.exe Infected: Trojan-Downloader.Win32.VB.ft
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7B0B27C5.htm Infected: Exploit.HTML.Mht
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7B36315F Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7B3A5B5C Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7B3D0558 Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7B402F54 Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7B435951 Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7C076EB8.exe Infected: Trojan.Win32.StartPage.nk
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7D8D3146.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7E591D55.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\7F606B23 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\Program Files\Sunbelt Software\CounterSpy Client\Quarantine\806B5AF9-53F4-4D1C-AF0B-2C8634\62B4EAA4-412E-40CD-8B7B-F158EB Infected: Trojan.WinREG.StartPage
C:\Program Files\Sunbelt Software\CounterSpy Client\Quarantine\9186E5F0-21F8-42BC-90F9-257124\181D8A25-072D-41D8-9B6F-C18BA8/stream Infected: not-a-virus:AdWare.Win32.InstaFinder.a
C:\Program Files\Sunbelt Software\CounterSpy Client\Quarantine\9186E5F0-21F8-42BC-90F9-257124\181D8A25-072D-41D8-9B6F-C18BA8 Infected: not-a-virus:AdWare.Win32.InstaFinder.a
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP41\A0018026.exe Infected: not-a-virus:AdWare.Win32.NewDotNet

Scan process completed.



---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 7:53:18 PM, 2/2/2006
+ Report-Checksum: 4CAFCDD

+ Scan result:

C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/CHCON.dll -> Adware.eZula : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/eabh.dll -> Adware.eZula : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/CHCON.dll -> Adware.eZula : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/eabh.dll -> Adware.eZula : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/mmod.exe -> Adware.eZula : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\10,31,2004_10,24,20.zip/seng.dll -> Adware.eZula : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\11,12,2004_21,16,37.zip/ken schram@centrport[1].txt -> Spyware.Cookie.Centrport : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\11,12,2004_21,16,37.zip/ken [removed][1].txt -> Spyware.Cookie.Sextracker : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\11,12,2004_21,16,37.zip/ken schram@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\11,13,2004_9,12,6.zip/ken [removed][1].txt -> Spyware.Cookie.Bridgetrack : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\11,13,2004_9,12,6.zip/ken schram@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\11,21,2004_11,42,37.zip/ken schram@centrport[1].txt -> Spyware.Cookie.Centrport : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\11,21,2004_11,42,37.zip/ken schram@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\11,28,2004_15,36,30.zip/ken schram@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/ken schram@bfast[1].txt -> Spyware.Cookie.Bfast : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/ken schram@centrport[1].txt -> Spyware.Cookie.Centrport : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/ken [removed][2].txt -> Spyware.Cookie.Coremetrics : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/ken [removed][2].txt -> Spyware.Cookie.Hitbox : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/ken schram@gator[2].txt -> Spyware.Cookie.Gator : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/ken schram@linksynergy[1].txt -> Spyware.Cookie.Linksynergy : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/ken schram@mediaplex[2].txt -> Spyware.Cookie.Mediaplex : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/ken schram@targetnet[2].txt -> Spyware.Cookie.Targetnet : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/ken [removed][1].txt -> Spyware.Cookie.Lop : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/mdefshop.dll -> Spyware.WurldMedia : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/SystemConfig0100.dll -> Spyware.WinAD : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,1,2004_11,42,43.zip/wtvh.dll -> Spyware.WildTangent : Ignored
C:\Program Files\NoAdware\NoAdwareBackup\5,14,2004_6,42,38.zip/ken schram@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Ignored


::Report End
Rogue
February 3, 2006, 2:11 PM UTC
Hi mrclean575,

Lets clean up the stuff your scan located.
Open NoAdware backup and remove all the files.
Open Norton Antivirus empty your Norton Antivirus Quarantine contents.
You can find instructions here
Open CounterSpy Client and empty your Quarantine contents.

==========

Empty your Recycle Bin
==========

Run ewido Malware Remover You want to remove all it finds this time.

Click on Scanner
Click on Complete System Scan and the scan will begin.
While the scan is in progress you will be prompted to clean files, click OK
Select "none" as the action. CHECK"Perform action with all infections ".
Once the scan has completed, there will be a button located on the bottom of the screen named Save report - click it.
Save the report.txt file to your desktop.

Now close ewido security suite.

Warning: While the scan is in progress, DO NOT open any folders or the Windows Control Panel !!
==========

Run another scan from Kapersky.
http://www.kaspersky.com/virusscanner

1. Click on "Kapersky Online Scanner"
2. A new smaller window will pop up. Press on "Accept". After reading the contents.
3. Now Kapersky will update the anti-virus database. Let it run.
4. Click on "Next">"Scan Settings", and make sure the database is set to "extended". And check both the scan options. Then click OK.
5. Then click on "My Computer". And the scan will start.
6. Once finished, save a log as ".txt" to the desktop. And restart.
==========

Post a new HJT Log
Post ewido Log
Post .txt from Kapersky

Thanks,
Rogue
mrclean575
February 3, 2006, 9:38 PM UTC
Logfile of HijackThis v1.99.1
Scan saved at 4:25:17 PM, on 2/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Ken Schram\Desktop\downloads\programs\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dial
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dial
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKCU\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /M "Stylus Photo R200" /EF "HKCU"
O4 - HKCU\..\Run: [Systweak Wallpaper Changer] wallpaper.exe -minimize
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Support - {2172C3A7-BB00-4CA4-B4CF-6A7B07CB0072} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: Ali Baba Slots TM by pogo - http://game1.pogo.com/applet-6.3.3.38/slots/alibaba-ob-assets.cab
O16 - DPF: Blackjack by pogo - http://game1.pogo.com/applet-6.4.2.23/blackjack/blackjack-ob-assets.cab
O16 - DPF: Buckaroo Blackjack TM by pogo - http://game1.pogo.com/applet-6.2.5.28/videoblackjack/videoblackjack-ob-assets.cab
O16 - DPF: EZ Win Bingo by pogo - http://game1.pogo.com/applet-6.2.5.42/bingo/bingoe-ob-assets.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.4.1.53/superbingo/superbingo-ob-assets.cab
O16 - DPF: Hearts by pogo - http://game1.pogo.com/applet-6.4.4.34/hearts/hearts-ob-assets.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.4.2.30/gin/gin-ob-assets.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.4.3.36/mahjong/mahjong-ob-assets.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.3.4.64/mlslots/mlslots-ob-assets.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-6.3.0.46/waterwheel/waterwheel-ob-assets.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-6.4.2.30/poppit2/poppit2-ob-assets.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.3.0.53/slots/showbiz2-ob-assets.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.2.0.37/slots/showbiz-ob-assets.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.4.4.34/wordwhomp2/whomp2-ob-assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.2.5.28/whackdown/whackdown-ob-assets.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.2.3.39/wordjong/wordjong-ob-assets.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/ ... nicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1138311113640
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax2822.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe



-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Friday, February 03, 2006 16:22:43
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 3/02/2006
Kaspersky Anti-Virus database records: 174641
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 53259
Number of viruses found: 43
Number of infected objects: 144
Number of suspicious objects: 0
Duration of the scan process: 5978 sec

Infected Object Name - Virus Name
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP41\A0018026.exe Infected: not-a-virus:AdWare.Win32.NewDotNet
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020244.exe Infected: Trojan-Downloader.Win32.VB.ft
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020245.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020246.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020247.dll Infected: Trojan-Clicker.Win32.Small.ez
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020248.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020249.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020250.exe/data0002 Infected: not-a-virus:AdWare.Win32.BetterInternet.a
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020250.exe/data0003/data0001 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020250.exe/data0003 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020250.exe Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020251.exe Infected: Trojan-Downloader.Win32.Apropo.ad
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020252.exe Infected: Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020253.dll Infected: not-a-virus:AdWare.Win32.EliteBar.af
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020254.exe Infected: Trojan-Downloader.Win32.Apropo.ad
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020255.exe Infected: Trojan-Downloader.Win32.Apropo.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020256.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020257.exe Infected: Trojan-Downloader.Win32.Apropo.ad
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020258.exe/data0000.bin Infected: Trojan-Downloader.Win32.Apropo.g
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020258.exe/data0002.bin Infected: Trojan-Downloader.Win32.Apropo.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020258.exe Infected: Trojan-Downloader.Win32.Apropo.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020259.com Infected: Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020260.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.e
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020261.exe Infected: Trojan-Downloader.Win32.Apropo.ad
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020262.DLL Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020263.exe Infected: Trojan-Downloader.Win32.Qoologic.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020264.exe Infected: Trojan-Downloader.Win32.Apropo.ab
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020265.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020266.exe Infected: Trojan-Downloader.Win32.Qoologic.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020267.exe/data0001 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020267.exe Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020268.dll Infected: Trojan-Downloader.Win32.Qoologic.t
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020269.exe Infected: not-a-virus:AdWare.Win32.WinAD.aw
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020270.exe Infected: Trojan-Downloader.Win32.Pacer.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020271.dll Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020272.exe Infected: Trojan-Downloader.Win32.Pacer.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020273.exe Infected: Trojan.Win32.StartPage.nk
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020274.exe Infected: Trojan-Downloader.Win32.VB.ft
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020275.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020276.exe Infected: not-a-virus:AdWare.Win32.WinAD.aw
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020277.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020278.exe Infected: not-a-virus:AdWare.Win32.WinAD.aw
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020279.srg Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020280.dll Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020281.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020282.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020283.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020284.dll Infected: Trojan-Downloader.Win32.Qoologic.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020285.exe Infected: Trojan-Downloader.Win32.Qoologic.v
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020286.cpl Infected: Trojan-Downloader.Win32.Qoologic.p
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020287.exe Infected: Trojan-Downloader.Win32.Qoologic.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020288.exe/data0003 Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020288.exe Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020289.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020290.exe Infected: Trojan-Dropper.Win32.Small.qn
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020291.exe Infected: Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020292.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020293.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020294.exe Infected: Trojan-Downloader.Win32.Small.abd
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020295.exe Infected: Trojan-Downloader.Win32.Qoologic.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020296.dll Infected: Trojan-Downloader.Win32.Qoologic.s
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020297.exe/data0002 Infected: Trojan.Win32.Registrator.b
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020297.exe/data0003 Infected: Trojan-Downloader.Win32.Small.ayh
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020297.exe Infected: Trojan-Downloader.Win32.Small.ayh
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020298.exe Infected: Trojan-Downloader.Win32.Apropo.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020299.exe Infected: Trojan-Dropper.Win32.Small.qn
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020300.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ag
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020301.exe Infected: Trojan-Downloader.Win32.Pacer.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020302.exe/data0002 Infected: not-a-virus:AdWare.Win32.BetterInternet.a
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020302.exe/data0003/data0001 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020302.exe/data0003 Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020302.exe Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020303.dll Infected: not-a-virus:AdWare.Win32.SafeSurfing.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020304.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020304.exe Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020305.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020306.exe Infected: Trojan-Downloader.Win32.Small.abd
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020307.vxd Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020308.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020309.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020310.exe Infected: Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020312.exe Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020313.dll Infected: not-a-virus:AdWare.Win32.BargainBuddy.l
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020314.exe Infected: not-a-virus:AdWare.Win32.SafeSurfing.i
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020315.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020315.exe Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020316.exe Infected: Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020317.dll Infected: Trojan-Downloader.Win32.Qoologic.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020318.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020318.exe/data0003 Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020318.exe Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020319.exe Infected: Trojan-Downloader.Win32.VB.ft
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020320.dll Infected: Trojan-Clicker.Win32.Small.ez
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020321.dll Infected: Trojan-Clicker.Win32.Small.ez
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020322.dll Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020323.exe Infected: Email-Worm.Win32.NetSky.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020324.com Infected: Trojan-Dropper.Win32.Agent.pb
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020325.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020325.exe/data0003 Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020325.exe Infected: not-a-virus:AdWare.Win32.CASClient.a
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020326.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.e
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020327.dll Infected: not-a-virus:AdWare.Win32.BookedSpace.e
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020328.exe Infected: Trojan.Win32.StartPage.nk
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020329.exe Infected: Trojan.Win32.StartPage.nk
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020330.dll Infected: not-a-virus:AdWare.Win32.HotSearchBar.i
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020331.exe Infected: Trojan.Win32.StartPage.nk
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0004/stream/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0004/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.aa
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0004/stream/data0006 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0004/stream/data0007 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0004/stream/data0008 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0004/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0005/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0005/stream/data0006 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0005/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0006/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.l
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0006/stream/data0006 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0006/stream/data0007 Infected: not-a-virus:AdWare.Win32.CashBack.b
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0006/stream/data0008 Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0006/stream Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe/stream Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020332.exe Infected: not-a-virus:AdWare.Win32.CashBack.d
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020333.dll Infected: not-a-virus:AdWare.Win32.HotSearchBar.i
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020334.dll Infected: Trojan-Downloader.Win32.Qoologic.p
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020335.exe Infected: not-a-virus:AdWare.Win32.WeirWeb.b
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020336.exe/data0000.bin Infected: Trojan-Downloader.Win32.Apropo.g
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020336.exe/data0002.bin Infected: Trojan-Downloader.Win32.Apropo.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020336.exe Infected: Trojan-Downloader.Win32.Apropo.u
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020337.dll Infected: Trojan-Clicker.Win32.Small.ez
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020338.exe Infected: Trojan.Win32.StartPage.nk
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020339.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020340.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020341.dll Infected: Trojan-Downloader.Win32.Qoologic.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020342.exe Infected: Trojan-Dropper.Win32.Agent.hl
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020343.exe Infected: Email-Worm.Win32.VB.an
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020344.exe/data0003 Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020344.exe Infected: not-a-virus:AdWare.Win32.Beginto.c
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020345.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\System Volume Information\_restore{D6264364-70EA-4D04-9365-1CB293908FE4}\RP53\A0020346.exe Infected: Trojan-Dropper.Win32.Agent.hl

Scan process completed.




---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 2:37:55 PM, 2/3/2006
+ Report-Checksum: 463B7855

+ Scan result:

No infected objects found.


::Report End
Rogue
February 3, 2006, 10:24 PM UTC
Well done mrclean575

The only signs of malware or virus left are in your system restore and the instructions for cleaning that are below. Other than that you appear clean. Are you still having any problems with you systems performance?

We have some general cleanup to do also.

Hide System Files
1. Click Start.
2. Open My Computer.
3. SelectTools menu
4. Click Folder Options.
5. Select the View Tab.
6. Uncheck Show hidden files and foldersin the Hidden files and folders section.
7. Select Hide protected operating system files (recommended) option.
8. Check the Hide file extensions for known file types option.
9. Click Yes.
10. Click OK.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  1. Turn off System Restore.
    On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    Check Turn off System Restore.
    Click Apply, and then click OK.

    Restart your computer

    Turn ON System Restore.
    On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    Un-Check Turn off System Restore.
    Click Apply, and then click OK.

    And that's all. But to help protect you against further infections, and also to help prevent criminals using your computer to infect other people's computers on the web, I recommend the following: (You may already have some of the items)
  2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
      1. Change the Download signed ActiveX controls to Prompt
      2. Change the Download unsigned ActiveX controls to Disable
      3. Change the Initialise and script ActiveX controls not marked as safe to Disable
      4. Change the Installation of desktop items to Prompt
      5. Change the Launching programs and files in an IFRAME to Prompt
      6. Change the Navigate sub-frames across different domains to Prompt
      7. When all these settings have been made, click on the OK button.
      8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
    5. Next press the Apply button and then the OK to exit the Internet Properties page.
  3. Use an Anti Virus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs:
    Click here for more information on -> Computer Safety On line - Anti-Virus

    I would recommend Grisofts© AVG or AVAST©. As these are the more secure and since they will block both in and out traffic.
  4. Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.
  5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below:
    Click here for more information on -> Computer Safety On line - Software Firewalls

    I would recommend ZoneAlarm© as a firewall as it's easy to use. But for a more secure firewall, Sunbelts Kerio© is the one.
  6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    Set up system to ensure a regular update of the Operating System.

    Automatically:
    1. On the Desktop, right-click My Computer.
    2. Click Properties.
    3. Click on Automatic Updates
    4. Check the option of choice (I use Automatic (Recommended)). If you use dial-up I would recommend using the
      Notify Me option so that you can download when you can afford the time and bandwidth overheads.
    5. Select the Day/Time of choice
    6. Click Apply
    7. Click OK


    Next, if they're not already present, I would recommend the download and installation of some or all of the following programs (all free), and the updating of them regularly
  7. Install Spybot© - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
    This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here: Click here for more info -->Instructions for - Spybot S & D and Ad-aware
  8. Install Lavasofts© Ad-Aware - Install and download Ad-Aware. You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot. A tutorial on installing & using this product can be found here: Click here for more info -->Instructions for - Spybot S & D and Ad-aware
  9. Install Javacools© SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer and Firefox settings and that will protect you from running and downloading known malicious programs. A article on anti-malware products with links for this program and others can be found here: Click here for more info -->Computer Safety on line - Anti-Malware
  10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and you are less susceptible to attacks.

Safe Surfing,

Rogue
mrclean575
February 3, 2006, 11:49 PM UTC
I've followed your instructions. Had all programs already installed, with the exception of a firewall. Been relying on my windows firewall, have now installed Kerio. Thank you so very much for all your help. Everything appears to be now working as it should. :)
Rogue
February 4, 2006, 2:10 AM UTC
You are very welcome. Glad MRU could be of assistance.
NonSuch
February 15, 2006, 8:43 AM UTC
Glad we could be of assistance.

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.